From 6c262d20d79e5201103959c9f342ae068e64f054 Mon Sep 17 00:00:00 2001
From: Andrew <mcdeweykp@gmail.com>
Date: Sat, 18 Dec 2021 19:31:21 -0500
Subject: [PATCH 1/6] Attempt fix for unzipping server dir

---
 app/classes/shared/main_controller.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/classes/shared/main_controller.py b/app/classes/shared/main_controller.py
index 11edcf2f..14f0da70 100644
--- a/app/classes/shared/main_controller.py
+++ b/app/classes/shared/main_controller.py
@@ -319,8 +319,11 @@ class Controller:
                     path_list = test.split('/')
                     root_path = path_list[0]
                     if len(path_list) > 1:
-                        for i in range(len(path_list)-2):
-                            root_path = os.path.join(root_path, path_list[i+1])
+                        for i in range(len(path_list)-1):
+                            try:
+                                root_path = os.path.join(root_path, path_list[i+1])
+                            except:
+                                root_path = root_path
 
                     full_root_path = os.path.join(tempDir, root_path)
 

From e53da60b4f9563c2f90dd4bc8d5641581e5ccdcd Mon Sep 17 00:00:00 2001
From: Andrew <mcdeweykp@gmail.com>
Date: Mon, 20 Dec 2021 12:51:27 -0500
Subject: [PATCH 2/6] Make files tree show up on page load

---
 app/frontend/templates/panel/server_files.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/frontend/templates/panel/server_files.html b/app/frontend/templates/panel/server_files.html
index 3f16e8c2..377a7355 100644
--- a/app/frontend/templates/panel/server_files.html
+++ b/app/frontend/templates/panel/server_files.html
@@ -139,7 +139,7 @@
                       <i class="far fa-folder-open"></i>
                       {{ translate('serverFiles', 'files', data['lang']) }}
                     </div>
-                    <ul class="tree-nested" id="files-tree">
+                    <ul class="tree-nested d-block" id="files-tree">
                       <li>{{ translate('serverFiles', 'error', data['lang']) }}</li>
 
                     </ul>
@@ -647,7 +647,7 @@
       document.getElementById("fileList").innerHTML = list;
   }, false);
 });
-    }
+  }
     function getTreeView() {
       $.ajax({
         type: "GET",
@@ -898,6 +898,8 @@
       target.classList.add('btn-primary');
     }
 
+    window.onload = getTreeView();
+
 </script>
 
 {% end %}
\ No newline at end of file

From 58d1ffea54fb2a26d429d5164f41f15c4faeec80 Mon Sep 17 00:00:00 2001
From: Andrew <mcdeweykp@gmail.com>
Date: Mon, 20 Dec 2021 20:17:28 -0500
Subject: [PATCH 3/6] Fix error with scheduled tasks by system Create a system
 user

---
 app/classes/models/users.py           | 19 ++++++++++++-------
 app/classes/shared/main_controller.py | 12 ++++++++++++
 app/classes/shared/main_models.py     |  3 +++
 main.py                               |  4 ++++
 4 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/app/classes/models/users.py b/app/classes/models/users.py
index f959a5bb..d6bd1607 100644
--- a/app/classes/models/users.py
+++ b/app/classes/models/users.py
@@ -70,7 +70,7 @@ class helper_users:
 
     @staticmethod
     def get_all_users():
-        query = Users.select()
+        query = Users.select().where(Users.username != "system")
         return query
 
     @staticmethod
@@ -79,8 +79,6 @@ class helper_users:
 
     @staticmethod
     def get_user_id_by_name(username):
-        if username == "SYSTEM":
-            return 0
         try:
             return (Users.get(Users.username == username)).user_id
         except DoesNotExist:
@@ -108,14 +106,14 @@ class helper_users:
         if user_id == 0:
             return {
                 'user_id': 0,
-                'created': None,
-                'last_login': None,
-                'last_update': None,
+                'created': '10/24/2019, 11:34:00',
+                'last_login': '10/24/2019, 11:34:00',
+                'last_update': '10/24/2019, 11:34:00',
                 'last_ip': "127.27.23.89",
                 'username': "SYSTEM",
                 'password': None,
                 'enabled': True,
-                'superuser': False,
+                'superuser': True,
                 'api_token': None,
                 'roles': [],
                 'servers': [],
@@ -130,6 +128,13 @@ class helper_users:
             #logger.debug("user: ({}) {}".format(user_id, {}))
             return {}
 
+    def check_system_user(user_id):
+        try:
+            Users.get(Users.user_id == user_id).user_id == user_id
+            return True
+        except:
+            return False
+
     @staticmethod
     def add_user(username, password=None, api_token=None, enabled=True, superuser=False):
         if password is not None:
diff --git a/app/classes/shared/main_controller.py b/app/classes/shared/main_controller.py
index 14f0da70..6d1fb694 100644
--- a/app/classes/shared/main_controller.py
+++ b/app/classes/shared/main_controller.py
@@ -3,6 +3,7 @@ import pathlib
 import time
 import logging
 import sys
+from app.classes.models.users import helper_users
 from peewee import DoesNotExist
 import schedule
 import yaml
@@ -120,6 +121,17 @@ class Controller:
         server_obj = self.get_server_obj(server_id)
         server_obj.reload_server_settings()
 
+    @staticmethod
+    def check_system_user():
+        if helper_users.get_user_id_by_name("system") is not None:
+            return True
+        else:
+            return False
+
+    @staticmethod
+    def add_system_user():
+        helper_users.add_user("system", helper.random_string_generator(64), helper_users.new_api_token(), False, True)
+
     def get_server_settings(self, server_id):
         for s in self.servers_list:
             if int(s['server_id']) == int(server_id):
diff --git a/app/classes/shared/main_models.py b/app/classes/shared/main_models.py
index 596fa372..31298062 100644
--- a/app/classes/shared/main_models.py
+++ b/app/classes/shared/main_models.py
@@ -74,8 +74,11 @@ class db_shortcuts:
         try:
             if query.count() > 0:
                 for s in query:
+                    if s.user_id == 0:
+                        print(s.user_id)
                     rows.append(model_to_dict(s))
         except Exception as e:
+            print('QUERY: ', query)
             logger.warning("Database Error: {}".format(e))
             pass
 
diff --git a/main.py b/main.py
index 0762e7e3..4526dc1d 100644
--- a/main.py
+++ b/main.py
@@ -6,6 +6,7 @@ import time
 import argparse
 import logging.config
 import signal
+from app.classes.controllers.management_controller import Management_Controller
 
 """ Our custom classes / pip packages """
 from app.classes.shared.console import console
@@ -146,6 +147,9 @@ if __name__ == '__main__':
         console.warning("We have detected Crafty's port, {} may not be open on the host network or a firewall is blocking it. Remote client connections to Crafty may be limited.".format(helper.get_setting('https_port')))
         console.help("If you are not forwarding ports from your public IP or your router does not support hairpin NAT you can safely disregard the previous message.")
 
+    if not controller.check_system_user():
+        controller.add_system_user()
+
     Crafty = MainPrompt(tasks_manager, migration_manager)
 
     def sigterm_handler(signum, current_stack_frame):

From 9ae0991f4bbdcfddcbbe3eb2105c55c0cc59db33 Mon Sep 17 00:00:00 2001
From: Andrew <mcdeweykp@gmail.com>
Date: Mon, 20 Dec 2021 20:24:27 -0500
Subject: [PATCH 4/6] Make system user not super user

---
 app/classes/shared/main_controller.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/classes/shared/main_controller.py b/app/classes/shared/main_controller.py
index 6d1fb694..e9c7750f 100644
--- a/app/classes/shared/main_controller.py
+++ b/app/classes/shared/main_controller.py
@@ -130,7 +130,7 @@ class Controller:
 
     @staticmethod
     def add_system_user():
-        helper_users.add_user("system", helper.random_string_generator(64), helper_users.new_api_token(), False, True)
+        helper_users.add_user("system", helper.random_string_generator(64), helper_users.new_api_token(), False, False)
 
     def get_server_settings(self, server_id):
         for s in self.servers_list:

From b4f247bb954d1f3d2dd1c9650b9acd8b9ec050e2 Mon Sep 17 00:00:00 2001
From: Andrew <mcdeweykp@gmail.com>
Date: Mon, 20 Dec 2021 22:34:20 -0500
Subject: [PATCH 5/6] Add final fixes for system user and automated backups

---
 app/classes/shared/main_models.py | 3 ---
 app/classes/shared/tasks.py       | 3 ++-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/app/classes/shared/main_models.py b/app/classes/shared/main_models.py
index 31298062..596fa372 100644
--- a/app/classes/shared/main_models.py
+++ b/app/classes/shared/main_models.py
@@ -74,11 +74,8 @@ class db_shortcuts:
         try:
             if query.count() > 0:
                 for s in query:
-                    if s.user_id == 0:
-                        print(s.user_id)
                     rows.append(model_to_dict(s))
         except Exception as e:
-            print('QUERY: ', query)
             logger.warning("Database Error: {}".format(e))
             pass
 
diff --git a/app/classes/shared/tasks.py b/app/classes/shared/tasks.py
index 47e390b9..927d4947 100644
--- a/app/classes/shared/tasks.py
+++ b/app/classes/shared/tasks.py
@@ -73,8 +73,9 @@ class TasksManager:
                 logger.info("Loading schedule ID#{i}: '{a}' every {n} {t} at {s}".format(
                     i=j.schedule_id, a=j.action, n=j.interval, t=j.interval_type, s=j.start_time))
                 try:
+                    print(self.controller.users.get_id_by_name('system'))
                     getattr(schedule.every(j.interval), j.interval_type).at(j.start_time).do(
-                        self.controller.management.send_command, 0, j.server_id, "127.27.23.89", j.action)
+                        self.controller.management.send_command, self.controller.users.get_id_by_name('system'), j.server_id, "127.27.23.89", j.action)
                 except schedule.ScheduleValueError as e:
                     logger.critical("Scheduler value error occurred: {} on ID#{}".format(e, j.schedule_id))
             else:

From 71d3e03875945093f4b5b17b0691f1575e349e87 Mon Sep 17 00:00:00 2001
From: Andrew <mcdeweykp@gmail.com>
Date: Mon, 20 Dec 2021 23:04:07 -0500
Subject: [PATCH 6/6] Add final fix for system user

---
 app/classes/web/panel_handler.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/classes/web/panel_handler.py b/app/classes/web/panel_handler.py
index 5847741d..7f0c1d1c 100644
--- a/app/classes/web/panel_handler.py
+++ b/app/classes/web/panel_handler.py
@@ -818,6 +818,8 @@ class PanelHandler(BaseHandler):
             self.redirect("/panel/server_detail?id={}&subpage=backup".format(server_id))
 
         elif page == "edit_user":
+            if bleach.clean(self.get_argument('username', None)) == 'system':
+                self.redirect("/panel/error?error=Unauthorized access: system user is not editable")
             user_id = bleach.clean(self.get_argument('id', None))
             username = bleach.clean(self.get_argument('username', None))
             password0 = bleach.clean(self.get_argument('password0', None))
@@ -914,6 +916,8 @@ class PanelHandler(BaseHandler):
 
 
         elif page == "add_user":
+            if bleach.clean(self.get_argument('username', None)):
+                self.redirect("/panel/error?error=Unauthorized access: username system is reserved for the Crafty system. Please choose a different username.")
             username = bleach.clean(self.get_argument('username', None))
             password0 = bleach.clean(self.get_argument('password0', None))
             password1 = bleach.clean(self.get_argument('password1', None))